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(54) A device suitable for controlling the injection of fuel into an internal combustion engine 



(57) A device comprises two processors 1 1 , 21. for example for controlling the injection of fuel into an internal combustion 
engine. Variables are detected (2) and at least one of the two processors calculates a manipulated variable for supplying (6) 
to a peripheral unit and controlling the fuel injection. The first processor 1 1 determines the manipulated variable in 
dependence on data, more particularly numerical data, calculated by the second processor 21 . Each processor 1 1 . 21 may 
comprise first and second computers 12, 13; 22, 23 and a monitor computer 14, 24. The processors may be connected by a 
data line having a duaJ-port RAM 8. The manipulated variable calculated by the first computer 12 may be compared in the 
monitor computer 24 with the manipulated variable calculated by the second computer 23 to detect faults and actuate a 
warning light 10.1 . A defective processor may be switched off and the other allowed to continue operation. Anti-skid braking 
systems and robots may alternatively be controlled by the device. 
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A device for controlling the injection of fuel into an 
internal combustion engine 

Description 

The invention relates to a device comprising two processors, 
more particularly for controlling the injection of fuel into 
an internal combustion engine according to the preamble of 
claim 1. 

A computer system comprising two processors and known in the 
prior art (DE-OS 35 39 407) is used for adjusting (or 
con trolling)~parameters of an engine— -A metering device 
uses detected variables such as the speed, engine power 
requirement or position of a brake pedal, to generate a set 
value for the amount of fuel to be injected, the set value 
being compared with an actual value detected at the control 
rod in the normal position and representing the amount of 
fuel injected* Depending on the measured difference, a 
manipulated variable is delivered to an end stage so as to 
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adjust the control rod. The set values, actual values and 
manipulated values processed in the present case are simple 
voltages, which unfortunately are subject to fluctuations, 
which may result in faulty adjustment of the control rod. 
Owing to the use of a number of change-over switches in the 
signal path, the signal processing is subject to faults. 
The known computer system has the additional disadvantage 
that the pick-ups detecting the variables are duplicated, 
which is complicated and expensive. In the event of a 
fault, the fault-monitoring devices simply switch off the 
end stage completely, so that emergency operation is 
impossible . 

The aim of the, invention is to provide a device comprising 
two processors which, in contrast to the prior art, ensures 
reliable signal processing and rapid determination of the 
manipulated variable • 

This problem is solved by the features disclosed in the 
characterising part of claim 1. 

Since the manipulated variable is calculated in the first 
processor in dependence on data calculated in the second 
processor, the manipulated variable can advantageously be 
determined quickly in dependence on the calculated 
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variables. Since digital data are processed, the signal 
processing is also reliable, since these data are not 
influenced e.g. by a fluctuation in the supply voltage. 
When the device according to the invention is used for 
controlling the fuel injection to an internal combustion 
engine, advantageous account is taken of operating 
parameters of the engine such as pressure, temperature, 
speed and more particularly the supply voltage (battery 
voltage). Other variables such as the power requirement 
(accelerator pedal position) can also be taken into account. 
In a special embodiment of the invention, these measured 
variables are used by the second processor to calculate a 
set of basic data which is supplied through suitable means 
(e.g. a data line) to the first processor, which uses the 
set of basic data to determine the manipulated variable for 
sending to the peripheral unit in order to control the fuel 
injection. The peripheral unit is e.g. at least one end 
stage for acfuating one or more injection valves (solenoid 
valves) or, in general, may be a device for controlling 
(influencing) the fuel injection (more particularly the 
beginning, end and rate of injection). 

According to another feature of the invention, the 
manipulated variable determined by the first processor can 
be supplied to the second processor via a data line, more 
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particularly with interposition of an input/output unit. 
The advantage of this is that the manipulated variable 
determined by the first processor is internally checked for 
plausibility by the second processor, thus increasing the 
reliability of signal processing* The input/output unit 
connecting the two processors is e.g. a central store to 
which processors have access and data can be written in and 
read out. 

According to another feature of the invention, both 
processors have at least one computer performing a primary 
function and one computer performing a secondary function in 
order to calculate the manipulated variable. The advantage 
of this is that if one processor fails, the other processor 
takes over calculating the manipulated variable. To this 
end, the computers in the first processor carry out at least 
some of the functions of the computers in the second 
processor ancT vice versa. This ensure that if the first 
processor fails, the computer performing the primary 
function in the second processor calculates the basic set of 
data and supplies them to the computer performing the 
secondary function in the secondary processor, which 
calculates the manipulated variable, which is sent to the 
peripheral unit. If the second processor fails, the 
manipulated variable is calculated in similar manner in the 
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first processor. If the computers have the same 
construction in both processors, the engine can continue to 
operate without restriction if either processor fails. If 
the computers in one processor carry out only some of the 
functions of the other processor, emergency operation of the 
engine is still possible. 

According to another feature of the invention, the two 
processors are associated with a monitoring device which 
influences the manipulated variable so that in the event of 
a fault in one of the two processors, the peripheral unit is 
supplied with the manipulated variable calculated by the 
functioning processor. By means of the monitoring device 
associated with the two processors, the peripheral unit in 
particular can be influenced so that the output of the 
defective processor (or the output of the peripheral unit) 
is switched off and the output of the functioning processor 
delivering tHe correctly calculated manipulated variable is 
connected to the peripheral unit or its input is activated. 
By this means, in the event of a fault in one of the two 
processors, the engine can continue to operate and faulty 
controls can be avoided. 

According to another feature of the invention, a monitoring 
computer is incorporated in each processor and supplied with 




the output signals of the computer performing the secondary 
function in one processor and the output signals of the 
computer performing the primary function in the other 
processor. The signals supplied to the monitoring 
computers, which represent the calculated manipulated 
variable, are checked for plausibility or similarity. In 
the event of a discrepancy, one of the monitoring computers 
delivers an appropriate control signal to the monitoring 
device, which appropriately actuates the peripheral unit. 
Alternatively the construction can be simplified by using 
only one monitoring computer in one of the two processors. 

According to another feature of the invention, the input 
variables supplied to the processors are processed by at 
least one of the processors in time-interlocked intervals, 
more particularly by multiplexing. This has the advantage 
that the variables appearing at the inputs of the processors 
are proces secT at desired times. ~ " 

■ 

The two-processor device according to the invention is not 
restricted to controlling the injection of fuel to an 
engine, but is of use whenever reliable signal processing 
and rapid determination of a manipulated variable are 
required. Once such application is e.g. to controlling the 
brake pressure in an anti-skid system or to the control of 
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robots in general. If the device according to the invention 
is used to control the fuel injection to an engine (the main 
sector of application) the engine can be either diesel or 



spark- ignition 



One particular embodiment of the device according to the 
invention and operation thereof will be explained in detail 
with reference to the drawings and the following 
description. In the drawings: 



Fig. 1 shows a device according to the invention for 
controlling the injection of fuel into an engine, and 

Fig. 2 shows the signal processing in a processor comprising 
a change-over device. 



Fig. 1 shows the device according to the invention for 
controlling the injection of fuel info "an internal 
combustion engine. The device substantially comprises a 
first processor 11 and a second processor 21, which is 
supplied with variables detected through sensor inputs 2. 
The detected variables, in the case of the device for 
controlling fuel injection, are operating parameters of the 
engine such as pressures, temperatures, speeds, positions 
(e.g. of the crankshaft) and, particularly advantageously, 
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the supply voltage (battery voltage) to ensure efficient 
reliable control of fuel injection into the engine. Other 
variables can be detected and processed, e.g. a variable 
representing idling or the position of a kick-down switch. 

The first processor 11 has a first computer 12 which 
performs a primary function of the first processor 11, and a 
second computer 13 which performs a secondary function of 
the first processor 11. A monitoring computer 14 is also 
incorporated in the first processor 11. The second 
processor 21 is constructed in similar manner to the first 
processor 11 and likewise has a first computer 22 and a 
second computer 23. A monitoring computer 24 is similarly 
incorporated in the second processor 21. The two processors 
11 and 21 are connected, for the purpose of transmitting 
signals, to a peripheral unit 4, e.g. at least one end stage 
for actuating solenoid valves. The solenoid valves or other 
f uel-raetering~components are actuated""" via at least one 
output line 6, which can be a data line or an electric line. 
The two processors 11, 21 are also interconnected by an 
input/output unit 8, more particularly a dual- port RAM, for 
the purpose of transmitting signals. A monitoring device 10 
followed by a diagnostic device 10.1 is associated with the 
two processors 11 and 21. The monitoring device 10 is 
connected to the peripheral unit 4 (connection between 
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points A and B) . In a simple embodiment, the diagnostic 
device 10.1 can be a warning light which is actuated in the 
event of a fault. Alternatively the diagnostic device 10.1 
can be a store, more particularly a non-volatile store, into 
which suitable fault reports can be written and subsequently 
read out via an interface. 

In the embodiment of the invention shown in Fig. 1, the 
individual components are connected as follows: 

The first computer 12, which calculates the manipulated 
variable, receives input signals in the form of data written 
into the input/output unit 8 and the basic data (set of 
basic data) calculated by the second computer 13. The 
output of the first computer 12 is connected to the 
peripheral unit 4 and to the monitoring computer 24 of the 
second processor 21. The second computer 13 of the first 
processor 11 has its input connected to' the sensor inputs 2 
and its output connected to an input of the first computer 
12 and to an input of the monitoring computer 14. The first 
computer 22 of the second processor 21 is supplied with the 
signals from the sensor inputs 2 and outputs signals to the 
second computer 23 and to the input/output unit 8. The 
second computer 23 has its output connected to the 
monitoring computer 24 and to the peripheral unit 4. The 
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monitoring device 10 associated with the two processors 11 
and 21 is connected to the two monitoring computers 14 and 
24. 

The aforementioned device for monitoring the fuel injection 
into an engine operates as follows: 

Variables detected via the sensor inputs 2 are supplied to 
the first computer 22 of the second processor 21, which 
calculates a set of basic data which is supplied via the 
input/output unit 8 to the first computer 12 of the first 
processor 11. The first computer 12, using the set of basic 
data, calculates a manipulated variable which controls the 
fuel injection (or the beginning and duration of delivery) 
and is supplied to the peripheral unit 4. In fault-free 
operation, the set of basic data calculated by the first 
computer 22 is supplied to the second computer 23, which 
corresponds at least partly in operation to the first 
computer 12 of the first processor 11. In similar manner to 
the first computer 12, the second computer 23 calculates the 
manipulated variable which is output to the monitoring 
computer 24. The manipulated variable calculated by the 
second computer 23 is compared with the manipulated variable 
calculated by the first computer 12 in the monitoring 
computer 24 and, in the event of an unacceptable 
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discrepancy, the monitoring device 10 is actuated. If the 
comparison shows a fault in the first computer 12, the 
monitoring device 10 switches off the output of the first 
processor 11 and supplies the peripheral unit 4 with the 
manipulated variable calculated by the second computer 23 of 
the second processor 21. Correspondingly the second 
processor 21 is switched off if the monitoring computer 14 
comparing its input signals finds an unacceptable 
discrepancy. In that case the manipulated variable will be 
calculated by the first computer 12, which is supplied with 
the set of basic data calculated by the second computer 13. 

By means of the aforementioned procedure, if a fault occurs 
in one of the two processors, the engine can continue to 
operate at least partially, using the functioning processor. 
If the computers 12, 13 and 22, 23. incorporated in both 
processors 11, 21 have the same design, full operation of 
the engine can be maintained. ~ 

Fig. 2 shows signal processing in a processor comprising a 
switching- over device. In addition to the components shown 
in Fig. 1 and bearing the same reference numbers, in Fig. 2 
a switching- over device 15 is connected upstream of the 
first computer 12 of the first, processor 11 and its input is 
connected to the monitoring device 10, the input/output unit 
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8 and the output of the second computer 13. In fault-free 
operation, therefore, the output signals of the input/output 
unit 8 are supplied to the first computer 12. In the event 
of a fault, the swi tching-over device 15 changes over to the 
output signals of the second computer 13, whose calculated 
set of basic data are then supplied to the first computer 
12. 



The signals input into the switching-over device 15 may be 
more or fewer than those shown in Fig. 2. Since the 
swi tching-over device 15 is a multiplexer, the first 
computer 12 of the first processor 11 is supplied with input 
signals in time-interlocked intervals, and can therefore 
process the input signals in succession. Other multiplexers 
can be used at other places in the device according to the 
invention. 

* 

The diagnostic device 10.1 associated^ with the monitoring 
device 10 in Fig. 1 is associated in Fig. 2 with the 
input/output unit 8 and performs the same function as 
described in Fig. 1. Alternatively, the diagnostic device 
10.1 can be associated with one or both processors 11, 21 
(more particularly the monitoring computer 14 or 24). By 
this means, an e.g. non-volatile store can be used to file 
plausibility faults of sensor signals or control signals in 
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the store and read out these recognised faults from the 
store and evaluate them, e.g. after a maintenance interval. 
Also, faults or disturbances occurring in the first 
processor 11 or its components or in the second processor 21 
or its components, can be determined as regards place, 
nature and frequency and filed in the non-volatile store. 



Alternatively, to avoid faulty controls, the output signals 
e.g. of the peripheral unit 4 can be limited by appropriate 
hardware. To this end, for example, the output signals, 
more particularly the beginning and rate of delivery, of the 
peripheral unit 4, can be limited so that the highest 
possible speed can be set only at the earliest possible 
beginning of delivery and the maximum possible delivery 
rate, so that the engine cannot race or overspeed. This is 
advantageous e.g. if the manipulated variable calculated by 
the first processor 11 (or by processor 21 in the event of a 
fault) is so "distorted during transmission as to result in 
an unacceptable speed of the engine. 



In an alternative embodiment essential to the invention, all 
computers (12, 13, 22, 23) or some computers and/or the 
monitoring computers (14 and/ or 24) can be provided with 
software, i.e. their operation or partial operation can be 
brought about in a program (e.g. at least one subroutine of 
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the main program of one of the two processors or an 
interrupt routine) • 
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CLAIMS 

» 

1. A device comprising two processors, more particularly 
for controlling the injection of fuel into an internal 
combustion engine, variables being detected and at least one 
of the two processors calculating a manipulated variable for 
supplying to a peripheral unit and controlling the fuel 
injection, characterised in that the first processor (11) 
determines the manipulated variable in dependence on data, 
more particularly numerical data, calculated by the second 
processor (21). 

2. A device according to claim 1, characterised in that 
the manipulated variable determined by the first processor 
can be supplied to the second processor (21) via a data 
line, more particularly with interposition of an 
input/output unit (8). 

3. A device according to claim 1 or 2, characterised in 
that both processors (ll, 12) have at least one computer 
(12, 13, 22, 23) performing a primary function and one 
computer performing a secondary function in order to 
calculate the manipulated variable. 
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4. A device according to any of the preceding claims, 
characterised in that the computers (12, 13) in the first 
processor (11) perform at least a part of the functions of 
the computers (22, 23) in the second processor (21) and vice 



versa. 



5. A device according to any of the preceding claims, 
characterised in that the processors (11, 21) are associated 
with a monitoring device (10) which influences the 
manipulated variable, more particularly a peripheral unit 
(4), and if a fault occurs in one of the two processors (11, 
21) the peripheral unit (4) is supplied with the manipulated 
variable calculated by the functioning processor. 



6. A device according to any of the preceding claims, 
characterised in that a monitoring computer (14, 24) is 
incorporated in each processor (11, 21). 



7. A device according to any of the preceding claims, 
characterised in that at least the processor (11) has a 
change-over device (15). 



8. A device according to any of the preceding claims, 
characterised in that the input variables supplied to the 
processors (11, 21) are processed by at least one of the 
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processors (11 t 21) in time-interlocked intervals, more 
particularly by multiplexing. 
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